git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] url: do not allow %00 to represent NULL in URLs

From
Matthew DeVore <matvore@comcast.net>
Date
Jun 4, 2019, 17:23 UTC
Message-ID
<20190604172352.GK4641@comcast.net>
In-Reply-To
<ca09cb2f-e376-1491-102d-0b06e49530a4@web.de>
On Tue, Jun 04, 2019 at 07:01:01AM +0200, René Scharfe wrote:
Show 6 quoted lines
> It's a bit hard to see with the (extended, but still) limited context,
> but url_decode_internal() effectively returns a NUL-terminated string,
> even though it does use a strbuf parameter named "out" for temporary
> storage.  So callers really have no use for decoded NULs, and this
> change thus makes sense to me.
> 
That was more or less my train of thought as well. Thank you for taking a look.
Previous: René ScharfeNext: Matthew DeVore
Message 6 of 9 in “Harden url.c URL-decoding logic”
  1. 0/2 Harden url.c URL-decoding logicMatthew DeVore, Jun 3, 2019
  2. 2/2 url: do not allow %00 to represent NULL in URLsMatthew DeVore, Jun 3, 2019
  3. brian m. carlsonJun 4, 2019
  4. Matthew DeVoreJun 4, 2019
  5. René ScharfeJun 4, 2019
  6. Matthew DeVoreJun 4, 2019
  7. 1/2 url: do not read past end of bufferMatthew DeVore, Jun 3, 2019
  8. René ScharfeJun 4, 2019
  9. Matthew DeVoreJun 4, 2019

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.